Static | ZeroBOX

PE Compile Time

2023-01-01 02:16:13

PE Imphash

c2fdfbe7cd82d7389fba16b58a347547

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002505a 0x00025200 7.4786917977
.data 0x00027000 0x00388c08 0x00002000 2.22514589265
.rsrc 0x003b0000 0x000027d0 0x00002800 4.3839714488

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x003b0ac8 0x000010a8 LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_ICON 0x003b0ac8 0x000010a8 LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_STRING 0x003b27a0 0x0000002a LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_STRING 0x003b27a0 0x0000002a LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_STRING 0x003b27a0 0x0000002a LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_STRING 0x003b27a0 0x0000002a LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_STRING 0x003b27a0 0x0000002a LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_GROUP_ICON 0x003b1b70 0x00000022 LANG_SINDHI SUBLANG_SYS_DEFAULT data
RT_VERSION 0x003b1b98 0x00000218 LANG_NEUTRAL SUBLANG_NEUTRAL data

Imports

Library KERNEL32.dll:
0x401004 DebugActiveProcess
0x401010 FindFirstFileW
0x401014 WriteConsoleInputW
0x40101c lstrlenA
0x401020 GetModuleHandleExA
0x401024 GetLocaleInfoA
0x401028 AllocConsole
0x401034 GlobalAddAtomA
0x401038 GetCommState
0x40103c WaitNamedPipeA
0x401040 ZombifyActCtx
0x40104c WriteConsoleInputA
0x401050 AddConsoleAliasW
0x401054 OpenSemaphoreA
0x40105c _lclose
0x401064 GetModuleHandleW
0x401070 ReadConsoleW
0x40107c SetCommState
0x401080 GetCommandLineA
0x401084 GetDriveTypeA
0x40108c GlobalAlloc
0x401090 AddRefActCtx
0x401094 LoadLibraryW
0x401098 ReadConsoleInputA
0x40109c CopyFileW
0x4010a0 _hread
0x4010a4 CreateEventA
0x4010a8 GetExitCodeProcess
0x4010ac GetConsoleAliasW
0x4010b0 GetFileAttributesW
0x4010b8 lstrlenW
0x4010bc GetStartupInfoW
0x4010c0 ReplaceFileA
0x4010c4 GetShortPathNameA
0x4010c8 GetConsoleAliasesW
0x4010cc GetStartupInfoA
0x4010d0 SetThreadLocale
0x4010d4 GetLastError
0x4010d8 SetLastError
0x4010e0 VerLanguageNameA
0x4010e4 CreateNamedPipeA
0x4010e8 CopyFileA
0x4010f0 SetStdHandle
0x4010f4 SetComputerNameA
0x4010f8 GetTempFileNameA
0x4010fc OpenWaitableTimerA
0x401104 AddAtomW
0x40110c RemoveDirectoryW
0x401110 FoldStringW
0x401114 FindNextFileA
0x401118 GetModuleHandleA
0x40111c lstrcatW
0x401120 FatalExit
0x401124 FindNextFileW
0x401128 VirtualProtect
0x401130 CompareStringA
0x401134 GetFileTime
0x401144 Module32NextW
0x401148 FindAtomW
0x40114c GetTempPathA
0x401150 ResetWriteWatch
0x401154 GetSystemTime
0x401158 EnumSystemLocalesW
0x40115c CommConfigDialogW
0x401160 DeleteFileA
0x401164 lstrcpyA
0x401168 HeapSize
0x40116c WideCharToMultiByte
0x401170 HeapAlloc
0x401174 HeapReAlloc
0x401178 GetCommandLineW
0x40117c HeapSetInformation
0x401180 DecodePointer
0x401188 IsDebuggerPresent
0x40118c EncodePointer
0x401190 TerminateProcess
0x401194 GetCurrentProcess
0x401198 GetCPInfo
0x4011a4 GetACP
0x4011a8 GetOEMCP
0x4011ac IsValidCodePage
0x4011b0 TlsAlloc
0x4011b4 TlsGetValue
0x4011b8 TlsSetValue
0x4011bc TlsFree
0x4011c0 GetCurrentThreadId
0x4011c4 GetProcAddress
0x4011cc ExitProcess
0x4011d0 WriteFile
0x4011d4 GetStdHandle
0x4011d8 GetModuleFileNameW
0x4011dc HeapCreate
0x4011e8 HeapFree
0x4011ec CloseHandle
0x4011f8 SetHandleCount
0x401200 GetFileType
0x40120c GetTickCount
0x401210 GetCurrentProcessId
0x401218 SetFilePointer
0x40121c GetConsoleCP
0x401220 GetConsoleMode
0x401224 Sleep
0x401228 LCMapStringW
0x40122c MultiByteToWideChar
0x401230 GetStringTypeW
0x401234 RaiseException
0x401238 RtlUnwind
0x40123c FlushFileBuffers
0x401240 WriteConsoleW
0x401244 CreateFileW
Library USER32.dll:
0x40124c CharUpperW
Library WINHTTP.dll:
0x401254 WinHttpReadData

!This program cannot be run in DOS mode.
`.data
(null)
`h````
xpxxxx
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
?ZEM-'^
?{yK+;
?765@Z
?e')lW
UUUUUU
333333
?333333
?UUUUUU
?$rxxx
`h`hhh
xppwpp
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
_nextafter
_hypot
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#QNAN
1#SNAN
weliha
yuhalilapu
zesolefuhezixoginakemarecose
limivojulizuta
ruvetav
lasahotutede
rabosowocokadozoyesobucuhizosofi
pakedipawixiru
gatojukimaludabojoyananehokafe
%s %d %f
0.1 %f
fiwobugizesurunonumevucugitimor
wurodigizusukexaturewes
neririwucumizalitetetidayohi goyumenofotusajuvela rag bakisam
boyotuvahosesarunifiducese
tiyafesuhotamonuboneyinu
xijubezujemuxihekobasa lepucuwed xacikorukewepobowexajuzer megajopetili
xikiyasoyudoharivahumexivebe
limiwejegeko
pepiyapiwisoyocipexokuge pikunatihadiriyujeriyu
Xof yoxupimawonofiyiw kujuyesebakabap
HHtXHHt
?If90t
to=X}B
tWItHIt9It
uTVWh)
^SSSSS
r=x{B
QQSVWh
j@j ^V
t"SS9] u
URPQQh
tRHtCHt4Ht%HtFHHt
PPPPPPPP
PPPPPPPP
;t$,v-
UQPXY]Y[
<+t"<-t
+t HHt
u-hPE@
PXV+wy+
-.~E1Lx
tIB7u1
^HJefR9N
CBr`>q
,y<uQt
>c/*S_
.LA=o)Y
?|"i0hLh
?"CFLw8
Q79@oP;z
VYoB53
#L`QzG
P(gPN
rR1#pz
Rt`9Rp
LukJgX
{l7ln&
mODp",M
5>l{#j
SJ7ca-
{kh~7d
s:vNmt
Ork*E3
&rad.":
l.B"aM38
vnGXQSSj
%Kv0[0
fJ02!)
DTX:sY
cmF)1K
r(Z7,`
+"Y/B5
Q&wa"8
.P|(='}
c_#PrB
3BZmlw
F:l6QpQ}M
)+3nJf
fiK`SZ
VQ[P.q
UeuMmg%
nl-^|w
V6[# d
z4y_8n
AAoJ'R;&D
4dNC X6
jPGF&f
)|5wU'X)T
$ZLexJ
JL_&:
\jMdynP(
PX`N@u
9pn1_Db
<fV!gny
,f1\V _
Yfv(m\
KBaj!o
n8Y#+?
cZH!>c
l9eanK
>67No_
f7p%&=Q
EH`Nm,DEOI
TW\lD7
R.vC<)
ny`/xN
^_?y#i)
}/PEHw/
`VCZ)5
dIpVH:
FE_u(d
5$ f(
)}$6`NWs
8hNod^
W.QzYE
mLW\BT
l{{?\
2VkG1v:
h.-P0+
J>1(0;
@LR_lt<~
2*$M+;
_pA`Uh
Ng6[#@
h3=Yxj
L4phN~
w?3lJz
Yd,fy,
$]~1iBb
Ii:yBb
bD<.ae
-mt@b!
xVo*m,
flMSd7$x{
QpT$U*HS
%2PzhT8
h5z)i5
+0O$m;
>Q{v55
\E},eX~W
9UD#~*
>d2%LL
BC]$`E
C\(dsG
.4Pu;
kBo=ugg
ir]@nS
|W,pmEC
?RN>p`
wfI@pZ
b+vVfu
#i\`U9W
58_j'"
2 (T0
;|Pmwze?22
3ilnL
<SVn('
lmdGi>m
CE}/QL
%i/H$G{
ruKccR}
-e(|jm
`f*WBf
+L!S:7&
Cjt&#\
U8y0I67j
5.)#g}8
#J>6lSH
qnDLF
w']BBg
Dl9bs&
D$HPQQh
T$PRPP
L$LQh|G@
GetVolumeNameForVolumeMountPointA
DebugActiveProcess
SetDefaultCommConfigA
RemoveVectoredExceptionHandler
FindFirstFileW
WriteConsoleInputW
WriteConsoleOutputCharacterW
lstrlenA
GetModuleHandleExA
GetLocaleInfoA
AllocConsole
GetProcessIoCounters
MapUserPhysicalPages
GlobalAddAtomA
GetCommState
WaitNamedPipeA
ZombifyActCtx
SetHandleInformation
SetConsoleScreenBufferSize
WriteConsoleInputA
AddConsoleAliasW
OpenSemaphoreA
GetSystemDefaultLCID
_lclose
MoveFileWithProgressA
GetModuleHandleW
GenerateConsoleCtrlEvent
FindNextVolumeMountPointA
ReadConsoleW
GetWindowsDirectoryA
GetConsoleAliasExesW
SetCommState
GetCommandLineA
GetDriveTypeA
GetEnvironmentStrings
GlobalAlloc
AddRefActCtx
LoadLibraryW
ReadConsoleInputA
CopyFileW
_hread
CreateEventA
GetExitCodeProcess
GetConsoleAliasW
GetFileAttributesW
GetCompressedFileSizeA
lstrlenW
GetStartupInfoW
ReplaceFileA
GetShortPathNameA
GetConsoleAliasesW
GetStartupInfoA
SetThreadLocale
GetLastError
SetLastError
ReadConsoleOutputCharacterA
VerLanguageNameA
CreateNamedPipeA
CopyFileA
EnumSystemCodePagesW
SetStdHandle
SetComputerNameA
GetTempFileNameA
OpenWaitableTimerA
UnhandledExceptionFilter
AddAtomW
SetCurrentDirectoryW
RemoveDirectoryW
FoldStringW
FindNextFileA
GetModuleHandleA
lstrcatW
FatalExit
FindNextFileW
VirtualProtect
GetCurrentDirectoryA
CompareStringA
GetFileTime
GetConsoleCursorInfo
QueryPerformanceFrequency
SetProcessShutdownParameters
Module32NextW
FindAtomW
GetTempPathA
ResetWriteWatch
GetSystemTime
EnumSystemLocalesW
CommConfigDialogW
DeleteFileA
lstrcpyA
KERNEL32.dll
CharUpperW
USER32.dll
WinHttpReadData
WINHTTP.dll
WideCharToMultiByte
HeapAlloc
HeapReAlloc
GetCommandLineW
HeapSetInformation
DecodePointer
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetProcAddress
IsProcessorFeaturePresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
EnterCriticalSection
LeaveCriticalSection
HeapFree
CloseHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
MultiByteToWideChar
GetStringTypeW
RaiseException
RtlUnwind
FlushFileBuffers
WriteConsoleW
HeapSize
CreateFileW
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
"???LL
yyyyyyyyyyyyyyyyyyyy
z{~z}|
~y}~~}
}{{z~~
||{z}}|}}}z
}}~|}~~
|{z}y~yz
~|~}~||z}
(null)
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
nKERNEL32.DLL
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
- abort() has been called
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
@Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
((((( H
h(((( H
H
WUSER32.DLL
BCONOUT$
kebowedimolasaxavixeyupocutu
vdupujebevepatiwesetizeda
biyuzo
wukizaferugututonoculafeca
mucisirovebawufudofutipijon zesetucozisaditanivoboxetor
gaginakecifetimopakikijehodeza
putufulivuzirilicodikayegohote layanuyacaxucayetenaravoyeh pahosajuxecomojiyexitidekaharaz xedavixulavusehodizukicoxagevod
unogasazamu
@jjjjjjj
VS_VERSION_INFO
StringFileInfo
037285B3
InternalName
Octupubrefestival.exe
LegalTrademark1
Clavion
LegalTrademarks2
Gunshut
OriginalFilename
Marabegda.exe
ProductVersion
1.25.86.34
VarFileInfo
Translation
Takubo tizuwixepu cixalexu
Lav vopohugibo hesibibi=Nisib venubokedep kasewetaleg sinevezacomosuz ramotun kugafinORolubetadovo yoyezed yizaduvup tiboputa cipepa kurej kizukamotu yocutuyahom sis7Holujuyasokicu gin xawevumo muzifotukujuxo dezonidijibo/Jilul jebomizegew xodaveguwehuva capozayupurahu
THox cexokavahadu zuziyecilo bedejodawiwinob kujem zefayos yenarag tajowic bizax rufi
NHelanutukimonu hejaratas hum veli sulo yonowofanonatir nutafemomojetug worubij
Ratajidamib bof wowuwSWibufisoxikez xezoguc puv jotov cixihuzora liwojiyixozizuv vuzufiroti gehomimenivapSDuhulayixuja pabidiperec caniz gipi wuwivijaduw hohe pifehojuref kibu zisocarupuvim
Lusebihub wuxovahu cizemuhuk
Ducojurami deyavunivacuCZefis fotutevilujuz hanir potufutowuzena sidihicahozav fatemubonanu
Nahipe vatadi
Yozelafasufu povepus*Fovu hicaxedixaluv yanejohimo cedibekicame3Lafevec dezu rire dahoxerisagebuy seb vubovibifaliw
Kogebilalayaw vuhevalabetikRece gazofoyawo bezikapiwe zatavicaxoki moraxilesa zijod domimizajakuso yekagep pawicifehekudi xesikugusope
KafugukehewanoEFadagu samutegerusav vukajesadic midasaw cunoz wisutazicizoj woxuguvi
?Loganikezi xupazacahapanux gazetigucoxeme nucisenub cupewejiyiy
Locuxajenave velolubuvugex
Vasimutipujoy
Antivirus Signature
Bkav W32.AIDetectMalware
Lionic Clean
tehtris Clean
Cynet Malicious (score: 100)
FireEye Generic.mg.a666eac4d7ffb6c0
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Lockbit.cc
McAfee Artemis!A666EAC4D7FF
Cylance unsafe
Zillya Clean
Sangfor Trojan.Win32.Save.a
K7AntiVirus Clean
Alibaba Clean
K7GW Hacktool ( 700007861 )
Cybereason malicious.60bdbf
Arcabit Clean
Baidu Clean
VirIT Clean
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Clean
APEX Malicious
Paloalto Clean
ClamAV Clean
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Clean
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan Clean
Avast Clean
Tencent Trojan.Win32.Obfuscated.gen
TACHYON Clean
Sophos ML/PE-A
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro Clean
Trapmine malicious.high.ml.score
CMC Clean
Emsisoft Clean
Ikarus Trojan.Win32.Ranumbot
Jiangmin Clean
Webroot Clean
Google Detected
Avira Clean
Antiy-AVL Clean
Kingsoft malware.kb.a.1000
Gridinsoft Clean
Xcitium Clean
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ViRobot Clean
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Clean
Varist Clean
AhnLab-V3 Clean
Acronis suspicious
BitDefenderTheta Clean
ALYac Clean
MAX Clean
VBA32 Malware-Cryptor.Azorult.gen
Malwarebytes Clean
Panda Clean
Zoner Clean
TrendMicro-HouseCall Clean
Rising Trojan.Generic@AI.88 (RDML:f4R5U1+5Hs5IeD61wT1NZQ)
Yandex Clean
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet Clean
AVG Clean
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)
No IRMA results available.